HIPAA Glossary · Laws & rules
Privacy Rule
The HIPAA regulation governing how PHI in any form may be used and disclosed, and the rights individuals hold over their information.
Context
The Privacy Rule lives at 45 CFR Part 164 Subpart E. It applies to PHI in every form — electronic, paper, oral — and defines permitted uses and disclosures, minimum necessary, patient rights, the Notice of Privacy Practices, and the accounting of disclosures. See [the Privacy Rule guide](/guides/hipaa-privacy-rule/) for the operational walk-through.
Related terms
- PHI — Protected health information — individually identifiable health information held or transmitted by a covered entity or business associate, in any form.
- TPO — The three purposes for which PHI may be used and disclosed without patient authorisation.
- Minimum necessary — The standard requiring uses, disclosures, and requests to be limited to the least PHI needed for the purpose.
- NPP — The document telling individuals how their PHI may be used and what rights they hold.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.